Aspects of the present invention generally relate to a method and computer program product for the detection of unintended computer application behaviors, whereby natural language processing (NLP) techniques are used to analyze the application (app), and specifically its graphical user interface (GUI), and construct an acceptable (or expected) list per-context actions. Actions executed by the app in a given context that do not fall within the list are flagged as unexpected (or anomalous).